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Improvement Service Progress Update 


Purpose 


1. To provide an update on the current status of Improvement Service Customer First — 
Citizen’s Account Service (renamed myaccount) with other organisations. 


Scottish Approach to verification and sign-in 


2. The Scottish Government announced in April 2014 its policy position for sign-in to online 
services, with myaccount being the national approach to secure and easy access to 
public services online. The links below provide the detail of the Scottish Government’s 
policy statement, and to the Scottish Government’s Digital Scotland blog on the policy. 


blogs.scotland.gov.uk 


www.scotland.gov.uk 


New service goes live 


3. As reported at the last meeting Customer First has been going through a period of 
change while working behind the scenes to refresh the Citizen’s Account. The need to 
replace ageing hardware and software, and introduce a number of improvements to 
make it easier for service providers to use and integrate, has largely driven the refresh 
and our efforts over the last six months. 


4. Are-branding exercise sees mygovscot ‘myaccount’ replacing the Citizen’s Account. The 
choice of myaccount has been quite deliberate, emphasising how - at its heart — 
myaccount is about extending personal choice and convenience to the public for how 
they securely access public services. 


5. A significant milestone was reached on Monday 14th April 2014 with the ‘soft launch’ of 
myaccount. The ‘soft launch’ represents a major step forwards in the roll out of the new 
service. The purpose of the ‘soft launch’ is allows us to work with current service users 
and early adopters to fine tune the new service prior to a larger effort over the coming 
months. The new service can be found at mygovscot. Please refer to the image below. 
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Service Overview 


6. Insimplest terms, the myaccount service provides for members of the public a secure 
and easy way of accessing public services online using just one username and 
password. 


7. In support of this the myaccount service provides a set of verification and single sign-in 
tools to help public sector partner organisations deliver authenticated online services to 
citizens. These tools include identity and property verification and validation facilities, 
registration and enrolment applications, user provisioning, self-service user account 
management, golden record seeding, federated authentication, candidate record 
processing and change of circumstances notifications. 


8. The service consists of the following components: 


A secure notification 
and messaging service 
for keeping Service 
Providers informed of 
changes of 
circumstances for their 
registered users, plus 
trust brokerage facilities 
to allow Service 
Providers to feed back 
transactional privilege 
elevations so that Levels 
of Assurance can be 
managed and 
maintained 


A secure web single A data management 
sign-on capability that service that maintains 
service providers can high levels of data 

use for their web- accuracy for 
facing applications, myaccount records, 
and includes tools for and provides Service 
service providers to set Providers with tools to 
up services and for improve the quality 
service users to and accuracy of their 
manage their accounts own local data 
and subscriptions 


A set of tools and 
business processes to 
validate and verify 
individuals and 
register service users 
for the myacccount 
service, and to resolve 
temporary person and 
address records 


myaccount myaccount myaccount 
sign-in data verify 


myaccount 
notify 





Service Uptake and Engagement 


9. 


13. 


A number of organisations have already gone live with the new service — City Of 
Edinburgh Council, mydiabetes myway, North Lanarkshire Council as well as the 
migration of the national entitlement card. 


. Since the last meeting we have had a number of workshops with other service providers. 


These include: 


South Lanarkshire Council 

Renfrewshire Council 

National Entitlement Card online (Dundee NECPO) 
My Diabetes My Way — NHS Tayside 

NHS National Services Scotland (NSS) — Information Services Division (ISD) 
NHS 24 - living it up 

NHS Lothian 

Mygovscot 

Angus Council 

Fife Council 

Information Sharing Board 

Central Government 


. These discussions follow on from engagements with the Local Government Information 


and Communication Technologies (ICT) Board and eHealth Programme Leads. We have 
also begun targeting some of the key suppliers working with councils on their websites 
and customer self-service implementation (for example Jadu, Northgate, Capita and 
Kana Lagan) to explore opportunities for myaccount. 


. In support of the priorities identified by the Local Government ICT Board the use of the 


myaccount is planned within the school online payments initiative, (a PIN has been 
issued for this initiative) as well as for online card management. 


The Improvement Service (IS) have ambitious plans for enrolling additional service 
provider organisations over the next 12 to 18 months. 


Information Assurance 


14. 


The Citizen Account System (CAS) has been operational for a number of years providing 
validation, verification, notification and authentication services for the National 
Entitlement Card, North Lanarkshire Council and MyDiabetesMyWay. The refresh means 
that although the changes to system functionality and information flow are minimal, there 
are areas of the underlying platform and service model that warrant a refreshed Privacy 
Impact Assessment (PIA), namely: 


e The service will be provided by a third party supplier using private cloud 
technology so it is important to ensure that DPA (Data Protection Act) and other 
information assurance obligations are clear and understood 


e Some of the solution requires to be developed and this will be carried out offshore 
(in India) 

e The Scottish Government requires the system to align as much as possible with 
emerging UK and European standards 

e Some additional information is being held in the system 


15. We have therefore taken the opportunity as part of the refresh work to review information 
assurance, data handling agreements, terms and conditions and Service Level 
Agreement (SLA) documentation etc with National Records Scotland and other partners. 
We have worked closely over the last few months to ensure that we have agreed revised 
arrangements for the future. 


16. External consultants have been engaged to undertake this work and we have had 
meetings with Scottish Government and National Records Scotland (NRS) and councils 
as part of the process. 


17. Anumber of streams of work have been completed or are underway. 


e Technical assurance due for completion in 2-3 weeks and an Information 
Assurance (IA) Management Plan in place. 

PIA for the new policy has been published by Scottish Government. 
Refresh of PIA for myaccount published by the Improvement Service. 
Terms and Conditions for users and Relying Parties under development. 
Revised SLAs and data sharing agreements in place with NRS. 

Interim Internal IA Accreditation has been signed off. 


18. Consideration has also been given to guide the development of governance and 
approaches for on-going assurance, including: 


e aformal accreditation stream using Her Majesty's Government (HMG) standards; 

e the establishment of an internal Information Assurance Operational Management 
group to ensure that information assurance and security principles are adhered to 
and maintained; and 

e the establishment of an Information Assurance Management Forum that draws 
membership from the wider stakeholder community and takes a broader and 
more strategic view of myaccount Information Assurance requirements. 
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19. The review of legislation (LEARS Act) conducted by Scottish Government (SG) and the 
Registrar General indicated not just the need to clarify the interpretation of the act which 
ensures legally that data held on the NHS Central Register can be provided to the 
Improvement Service but the need to put in place arrangements for use of the Unique 
Citizen's Reference number ( UCRN) by central government. 


Address information developments 


20. The Improvement Service (IS) has been actively involved in promoting the adoption of 
the Unique Property. Reference Number (UPRN) into all NHS systems. Meetings have 
taken place with ehealth and NHS National Services Scotland to discuss the deployment 
of Addressbase (an Ordnance Survey product). Adddressbase is available to NHS 
through the new One Scotland Mapping Agreement. This provides access to a quality 
assured national address dataset. Addressbase incorporates the One Scotland gazetteer 
and the Royal Mail Postcode Address File (PAF). Addressbase is now being used by 
myaccount. This supports improving the accuracy of address information that will support 
improved service delivery and information sharing and is seen as a key benefit of the 
relationship between myaccount and NHS Central Register. In addition we have worked 
with Scottish government to agree a public sector PAF licence with Royal mail. This will 
remove individual organisations requirement to have a licence to use PAF data. 


Recommendations 


21. The Board is asked to: 


e note the progress with implementing a new service; 

e note that revised and improved information assurance and governance 
arrangements are in place; and 

e note the opportunity for wider adoption of the UPRN. 


